Change Details

Mozilla introduced the field CKA_NSS_SERVER_DISTRUST_AFTER which indicates that a server CA certificate will be distructed in the future before its NotAfter time. This means that the CA stops issuing new certificates, but previous ones are still valid until they expire. We can ignore this until Mozilla removes it altogether from the bundle. See also: * https://github.com/Lukasa/mkcert/issues/19 * https://gitlab.alpinelinux.org/alpine/ca-certificates/-/merge_requests/16 * https://github.com/curl/curl/commit/448df98d9280b3290ecf63e5fc9452d487f41a7c Tested by: michaelo

Mozilla introduced the field CKA_NSS_SERVER_DISTRUST_AFTER which indicates that a CA certificate will be distrusted in the future before its NotAfter time. This means that the CA stops issuing new certificates, but previous ones are still valid, but at most for 398 days after the distrust date. See also: * https://github.com/Lukasa/mkcert/issues/19 * https://gitlab.alpinelinux.org/alpine/ca-certificates/-/merge_requests/16 * https://github.com/curl/curl/commit/448df98d9280b3290ecf63e5fc9452d487f41a7c

Mozilla introduced the field CKA_NSS_SERVER_DISTRUST_AFTER which indicates that a server CA certificate will be distructedsted in the future before its NotAfter time. time. This means that the CA stops issuing new certificates, but previous ones are are still valid until they expire., We can ignore this until Mozilla removes it altogether from the bundlebut at most for 398 days after the distrust date. See also: * https://github.com/Lukasa/mkcert/issues/19 * https://gitlab.alpinelinux.org/alpine/ca-certificates/-/merge_requests/16 * https://github.com/curl/curl/commit/448df98d9280b3290ecf63e5fc9452d487f41a7c Tested by: michaelo